Organizations face new extortion threats after Ransomware attacks

Organizations that have fallen victim to ransomware are receiving offers from fake “security researchers” who claim they can wipe stolen data.

According to a report by Arctic Wolf security researchers, during the cases recorded in October and November 2023, the actors presented themselves as “Ethical Side Group” and “xanonymoux”.

Hackers threatened companies hit by ransomware with data deletion if they paid less than 5 Bitcoins (around €200,000). The threats also included the risk of future attacks, while mentioning the volume of stolen data.

Read more: Hackers breach Google accounts without passwords

Researchers suspect that the same hacker may be behind these offers. Although an organization paid the ransom in one case, the next extortion failed.

However, it is still not clear whether the initial ransomware groups imposed sanctions for the subsequent extortion cases, or if the threat actor acted autonomously to gather additional funds from victim organizations.

Arctic Wolf worked with victims of the initial ransomware attacks, providing support only in information recovery, according to a company spokesperson to Help Net Security.

In both cases, file lists were provided by the threat actor, but no file content was provided. Furthermore, the total volume of data collected was accurately reported by the threat actor.
The victim paid the initial ransom and the “hacker actor” revealed the amount paid during their communications.

So far, extortion attempts have failed, but the complexity of cyber threats demonstrates the difficulty organizations face in dealing with the impacts of ransomware attacks.

Source: helpnetsecurity.com